How we use data

Scheduling data

We store the plan name, dates and times, participants' names and availability, and any starting stations and meeting place to coordinate the plan and show the result. Passwords are stored as verification hashes rather than plain text.

Per-browser usage metrics

We record visits, plan creation, joining a plan, submitting times and confirmation. A random identifier stored in your browser counts return visits. Analytics records never include names, passwords, selected times or plan names. We do record a random plan ID to tell plans apart.

Traffic analysis records the public landing page, language, traffic type, search or AI service, referring domain, and campaign source identifier (utm_source). We do not record full referring URLs, paths, search terms, other query values, or private room URLs. Campaign sources are limited to identifiers of up to 64 ASCII letters, digits, underscores, or hyphens. Initial attribution stays in the browser tab for 30 minutes.

Notifications

If you turn on “Get notified when it’s confirmed,” we save an address and encryption keys for sending notifications to that browser, linked to the room. When the host confirms a time, we send a notification with the plan name and confirmed time to that address. If the host turns on “Get notified about new answers” in their room, we save the same kind of address, and send the host a notification with the plan name, the answerer’s name and the number of answers when someone answers for the first time, and with the plan name and the number of answers when the answer deadline passes. To avoid repeating the deadline notification, we save the room ID and the deadline it was sent for. It is deleted when you turn notifications off or the room is deleted, and addresses the browser has unsubscribed are deleted at the next send.

Retention period and notes

Plan data currently has no automatic deletion period. When the host deletes a plan, its contents and authentication data are removed from the live database; only cumulative counts that cannot be linked back to a person or plan are kept. The plan ID and deletion time are used for deleted-link notices for 30 days; expired records are cleared during later deletions or missing-plan lookups. Usage metrics older than 180 days are deleted when new metrics are saved. Disaster-recovery backups may retain information from before deletion and are not used for normal service queries. Clearing browser data also removes this device's identifiers and plan records.